You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@dubbo.apache.org by GitBox <gi...@apache.org> on 2022/10/26 06:58:01 UTC
[GitHub] [dubbo] Suremotoo opened a new issue, #10833: Dubbo 反序列化漏洞，升级至 2.7.18 版本后，Dubbo-admin 无法进行方法测试
Suremotoo opened a new issue, #10833:
URL: https://github.com/apache/dubbo/issues/10833
- [x] I have searched the [issues](https://github.com/apache/dubbo/issues) of this repository and believe that this is not a duplicate.
### Environment
* Dubbo version: 2.7.18
* Operating System version: macOS
* Java version: "1.8.0_342"
### Steps to reproduce this issue
1. 原本服务使用 Dubbo 2.7.3 ，Dubbo-admin 使用 0.1、0.3.0、0.5.0 的版本都没有问题
2. 升级至 Dubbo 2.7.18 后，Dubbo-admin 在进入方法测试的时候，均提示 `System Error, please try again later! Message:null`
<img width="792" alt="CleanShot 2022-10-26 at 14 54 44@2x" src="https://user-images.githubusercontent.com/26423989/197955645-30e62e70-7553-4b3d-ad11-05ac4d59ac2c.png">
我使用官方提供的 demo 更换版本后并重现了此问题
https://github.com/apache/dubbo-samples/tree/master/dubbo-samples-spring-boot
调整上述工程的 Dubbo 版本至 2.7.18 ，使用任意版本的 Dubbo-admin 均可复现问题。
> 使用低版本 2.7.3 及 高版本 3.0.7 却能正常解析，我怀疑是 Dubbo 2.7.18 或者在某个之前版本进行过这部分调整，所以在 apache/Duddo 项目中提出此问题
我通过 Dubbo-admin 断点调试，发现获取到的`元数据 ProviderMetaData` 变成了对象引用形式(`$ref`) 导致无法正确解析接口参数信息，下面提供本次异常情况（Expected Behavior）、正常情况（Actual Behavior）的部分示例信息：
### Expected Behavior
```json
{
"parameters":
{
"side": "provider",
"interface": "org.apache.dubbo.springboot.demo.DemoService",
"pid": "89629",
"application": "dubbo-springboot-demo-provider",
"dubbo": "2.0.2",
"release": "3.0.7",
"anyhost": "true",
"bind.ip": "10.193.99.224",
"methods": "sayHello,sayHelloAsync",
"background": "false",
"deprecated": "false",
"dynamic": "true",
"service-name-mapping": "true",
"qos.enable": "false",
"generic": "false",
"bind.port": "20881",
"timestamp": "1666762729287"
},
"canonicalName": "org.apache.dubbo.springboot.demo.DemoService",
"codeSource": "file:/Users/suremotoo/IdeaProjects/demo/dubbo-samples/dubbo-samples-spring-boot/dubbo-samples-spring-boot-interface/target/classes/",
"methods":
[
{
"name": "sayHelloAsync",
"parameterTypes":
[
"java.lang.String"
],
"returnType": "java.util.concurrent.CompletableFuture",
"annotations":
[]
},
{
"name": "sayHello",
"parameterTypes":
[
"java.lang.String"
],
"returnType": "java.lang.String",
"annotations":
[]
}
],
"types":
[
{
"type": "java.util.concurrent.CompletableFuture",
"properties":
{
"result": "java.lang.Object",
"stack": "java.util.concurrent.CompletableFuture.Completion"
}
},
{
"type": "java.lang.Object"
},
{
"type": "java.lang.String"
},
{
"type": "java.util.concurrent.CompletableFuture.Completion",
"properties":
{
"next": "java.util.concurrent.CompletableFuture.Completion",
"status": "int"
}
},
{
"type": "int"
}
],
"annotations":
[]
}
```
### Actual Behavior
```json
{
"annotations":
[],
"canonicalName": "org.apache.dubbo.springboot.demo.DemoService",
"codeSource": "file:/Users/suremotoo/IdeaProjects/demo/dubbo-samples/dubbo-samples-spring-boot/dubbo-samples-spring-boot-interface/target/classes/",
"methods":
[
{
"annotations":
[],
"name": "sayHelloAsync",
"parameterTypes":
[
"java.lang.String"
],
"parameters":
[],
"returnType": "java.util.concurrent.CompletableFuture"
},
{
"annotations":
[],
"name": "sayHello",
"parameterTypes":
[
"java.lang.String"
],
"parameters":
[],
"returnType": "java.lang.String"
}
],
"parameters":
{
"side": "provider",
"service.name": "ServiceBean:/org.apache.dubbo.springboot.demo.DemoService",
"release": "2.7.18",
"methods": "sayHello,sayHelloAsync",
"deprecated": "false",
"dubbo": "2.0.2",
"interface": "org.apache.dubbo.springboot.demo.DemoService",
"qos.enable": "false",
"generic": "false",
"metadata-type": "remote",
"application": "dubbo-springboot-demo-provider",
"dynamic": "true",
"anyhost": "true"
},
"types":
[
{
"enums":
[],
"items":
[],
"properties":
{},
"type": "int",
"typeBuilderName": "org.apache.dubbo.metadata.definition.builder.DefaultTypeBuilder"
},
{
"enums":
[],
"items":
[],
"properties":
{},
"type": "java.lang.Object",
"typeBuilderName": "org.apache.dubbo.metadata.definition.builder.DefaultTypeBuilder"
},
{
"enums":
[],
"items":
[],
"properties":
{},
"type": "java.lang.String",
"typeBuilderName": "org.apache.dubbo.metadata.definition.builder.DefaultTypeBuilder"
},
{
"enums":
[],
"items":
[],
"properties":
{
"result":
{
"$ref": "$.types[1]"
},
"stack":
{
"enums":
[],
"items":
[],
"properties":
{
"next":
{
"$ref": "java.util.concurrent.CompletableFuture$Completion",
"enums":
[],
"items":
[],
"properties":
{},
"type": "java.util.concurrent.CompletableFuture$Completion",
"typeBuilderName": "org.apache.dubbo.metadata.definition.builder.DefaultTypeBuilder"
},
"status":
{
"$ref": "$.types[0]"
}
},
"type": "java.util.concurrent.CompletableFuture$Completion",
"typeBuilderName": "org.apache.dubbo.metadata.definition.builder.DefaultTypeBuilder"
}
},
"type": "java.util.concurrent.CompletableFuture",
"typeBuilderName": "org.apache.dubbo.metadata.definition.builder.DefaultTypeBuilder"
},
{
"$ref": "$.types[3].properties.stack"
}
],
"uniqueId": "org.apache.dubbo.springboot.demo.DemoService@file:/Users/suremotoo/IdeaProjects/demo/dubbo-samples/dubbo-samples-spring-boot/dubbo-samples-spring-boot-interface/target/classes/"
}
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For additional commands, e-mail: notifications-help@dubbo.apache.org
[GitHub] [dubbo] AlbumenJ commented on issue #10833: Dubbo 反序列化漏洞，升级至 2.7.18 版本后，Dubbo-admin 无法进行方法测试
Posted by GitBox <gi...@apache.org>.
AlbumenJ commented on issue #10833:
URL: https://github.com/apache/dubbo/issues/10833#issuecomment-1292919343
这个是 fastjson 的机制，可以在 dubbo-admin 中做下兼容
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For additional commands, e-mail: notifications-help@dubbo.apache.org